European UnionGDPR Chapter V, Cross-Border Transfer Restrictions
Regulation (EU) 2016/679, Arts. 44-50
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 25 May 2018.
A cross border transfer rule binding public and private bodies.
As of 23 August 2026.
What it requires
- Rely on a Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in the EU outside the EEA.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 83(5)(c) subjects an infringement of the cross-border transfer conditions in Articles 44 to 49 to the higher administrative-fine tier, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher. Article 50, on international cooperation mechanisms, states no separate penalty and is not named in Article 83(5)(c).
- Rule
- Higher of
- As of
- 2 September 2026
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
The data protection supervisory authority designated by each EU Member State under Article 51, coordinated on cross-border cases through the one stop shop mechanism and the European Data Protection Board (Articles 68-76).
Enforcement record
CMS GDPR Enforcement Tracker Report, 7th edition (cut-off 1 March 2026, published 21 May 2026): 2,685 fines with complete amount, date and controller information recorded across the EU/EEA since the GDPR became applicable on 25 May 2018 (3,062 including cases with incomplete information), totalling approximately EUR 6.11 billion, the first time the tracker's cumulative total crossed EUR 6 billion. actions_per_year (440) and fines_per_year (approximately EUR 487.6 million) are the report's own comparison against its prior, 2025 edition (roughly a one-year interval between editions), not a fixed calendar year; trend is recorded as rising on that reported increase. Counts DPA-imposed administrative fines only; the report does not separately track private civil claims under Article 82. This is the Regulation's enforcement record as a whole, not specific to Chapter V.
- As of
- 2 September 2026
- Trend
- Rising
- Currency
- EUR
- Source link
- https://cms.law/en/int/publication/GDPR-Enforcement-Tracker-Report/numbers-and-figures
- Total fines
- 6,110,000,000
- Fines per year
- 487,600,000
- Actions per year
- 440
What it reaches
Obligation class
Transfer
Who checks it
Audit expectation
continuous
Who audits it
Self
Where the report goes
Produced on request
Also on the record
EEA status
- Annex
- XI
- Status
- Incorporated
- Force date
- 20 July 2018
- Joint committee decision number
- 154/2018
- Source link
- https://www.efta.int/eea-lex/32016r0679
- Decision date
- 6 July 2018
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Chapter V bars any transfer of personal data outside the EEA unless the European Commission has issued an adequacy decision (Article 45), the transfer is covered by an appropriate safeguard such as Standard Contractual Clauses or Binding Corporate Rules together with a transfer impact assessment under the Court of Justice's Schrems II judgment (Case C-311/18, 16 July 2020), or a narrow Article 49 derogation applies.
Most transfers to the United States currently rely on the EU-US Data Privacy Framework, found adequate by Commission Implementing Decision (EU) 2023/1795. The General Court upheld that adequacy decision at first instance in Latombe v Commission (Case T-553/23, 3 September 2025). An appeal against that judgment is pending before the Court of Justice as Case C-703/25 P, with no hearing date set as of the date shown.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachprocesses_voiceprocesses_biometrics
Read the law
Official Journal text, EUR-Lex, Regulation (EU) 2016/679
Commission Implementing Decision (EU) 2023/1795
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.